Lion Cipher Lab
Extract IOCs from a threat report
- Threat Intel Analyst
- Beginner
- ~40 min
- Free · no account required
Why it matters
Threat reports are how the security community warns each other, and almost every serious one ends with a block of indicators of compromise — the hashes, IP addresses, domains, and URLs tied to the attack. But they arrive as prose and screenshots, with the dangerous parts deliberately broken so nobody clicks them. A defender who can turn that mess into a clean, validated, machine-readable list is doing one of the most common day-one tasks in a security operations centre: feeding fresh intelligence into the tools that actually watch the network. This lab teaches that pull-clean-check-format…
What you'll learn
- what an IOC is (hashes, IPs, domains, URLs, emails)
- reading a real public threat report
- extracting IOCs by hand and with regex
- using iocextract
- defanging and refanging (hxxp, [.]) and why it matters
- deduping and validating indicators before you act on them
- formatting IOCs as CSV and understanding STIX
- the Pyramid of Pain and why IOCs are brittle
Steps in this lab
- What an IOC is, and the shapes it comes in
- Get a real report to work from
- Extract by hand first, so you know what "good" looks like
- Extract with a tool: install and run iocextract
- Defanging and refanging: hxxp, [.], and why reports break their own links
- Dedupe and validate: an IP in a report is not automatically safe to block
- Format for use: a simple CSV, and a word on STIX
- The honest ceiling: IOCs sit at the bottom of the Pyramid of Pain